Ultimate responsibility has a name
The management body shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework — and must bear the ultimate responsibility for managing the entity's ICT risk, set the risk tolerance, approve the digital operational resilience strategy, and set clear roles for every ICT-related function.
Why it is like this
ICT risk had been delegated down to a function with no budget authority and no seat at the table. Putting final responsibility on the board is the lever: it makes under-resourcing a governance failure rather than an IT complaint.
Not to be confused with
A sign-off. The Regulation lists active duties — approving the policy on the use of ICT third-party services, reviewing it, setting reporting lines — and makes the body accountable for them, which is a different thing from having read a paper.
In practice
"The board approved the strategy in 2023 and has not looked since" is not compliance; the framework is to be reviewed at least annually and after every major incident.
Source: Regulation (EU) 2022/2554 (DORA) — Art. 5. Read on .
Say it back Check yourself
Name four things DORA requires the management body itself to do about ICT risk.
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- Bear the ultimate responsibility for managing the entity's ICT risk
- Define, approve, oversee and be responsible for implementing the ICT risk management framework
- Set clear roles and responsibilities for all ICT-related functions
- Bear overall responsibility for setting and approving the digital operational resilience strategy, including the risk tolerance level
- Approve, oversee and periodically review the ICT business continuity policy and response and recovery plans
- Keep its own knowledge and skills up to date through regular training
Any four. The budget one is the one that gets quoted back at boards, because it turns "we asked for funding" into a regulatory question.